Method for storing odometer data

ABSTRACT

A method for storing odometer reading data in a vehicle having control units which are connected via a data bus. The odometer reading data, which is determined at a particular time by an odometer, is stored in a storage means of a first control unit. This provides an alternative method for tamper-proof storage of odometer reading data and, in particular, improved protection against errors during the transmission of the odometer reading data. The current odometer reading data of at least one further control unit is then stored on the data bus in a storage means. The control units transmit the odometer reading data, which is stored at a particular time, onto the data bus at specific time intervals, and a control unit accepts the odometer reading transmitted onto the data bus if that reading is higher than its stored value, and uses that value for the further counting and storage in the particular control unit.

This application claims the priority of German Application No. 101 38703.2, filed Aug. 7, 2001, the disclosure of which is expresslyincorporated by reference herein.

BACKGROUND AND SUMMARY OF THE INVENTION

The invention relates to a method for the tamper-proof storage of theodometer reading in a vehicle.

The tamper-proof storage of a distance covered by a vehicle is veryimportant. Recently, insurance companies have attempted to make theirpremiums for vehicles dependent on the distance which they travelannually. In addition, the odometer reading is a decisive factor indetermining the price when a secondhand car is bought or sold.

U.S. Pat. No. 4,710,888 discloses a method for measuring, displaying andstoring the distance covered by a vehicle, in which the accumulated andupdated odometer reading data is stored in a nonvolatile memory. Anessential feature of the method is the optimized addressing for thestorage of the accumulated odometer reading data in the nonvolatilememory in order to avoid unnecessary writing/deletion access operationsto the nonvolatile memory. In addition, the method which is used whenwriting to the nonvolatile memory permits checking for faults to becarried out by setting and comparing an additional parity bit for eachstored data value.

U.S. Pat. No. 4,803,707 discloses a circuit for digitally storingodometer reading data, which is intended to increase the service life ofthe nonvolatile memory. Here, the significant digital value of anodometer reading is set as an address pointer for the nonvolatile memoryin which the non-significant digital value of the odometer reading isthen stored. In addition, electronic tampering with odometer readingdata is prevented in that, during writing, an additional flag is setwhich cannot be deleted and is additionally checked.

German Patent No. DE 19821696 discloses a method and a device for thetamper-proof storage of odometer reading data of a vehicle. Here, thedata which is determined by a counting unit is transmitted in encryptedform to a receiver unit. In the receiver unit the data is encrypted andstored.

Japanese Patent No. 06241825 A discloses an electronic odometer in whichthe respective reading is stored in a non-volatile memory and also in aprocessor part and a display part. In order to prevent misuse, when thenon-volatile memory is tampered with at the start of the process partthe odometer reading information contained there is written back intothe non-volatile memory.

The object of the present invention is to make available an alternativemethod for the tamper-proof storage of odometer reading data. Here inparticular the protection against errors during the transmission of theodometer data is improved.

The object is achieved according to the invention by storing the currentodometer reading data of at least one further control unit on the databus in a memory. The control units transmit the odometer reading data,which is stored at a particular time, onto the data bus at specific timeintervals. A control unit accepts the odometer reading transmitted ontothe data bus only if the reading is higher in value than its storedvalue. This value is used by the control unit for the further countingand storage.

The redundant storage of the odometer reading data in the furthercontrol units enhances the protection against tampering. Possibletampering would then have to be carried out not only in the firstcontrol unit but also in the further control units.

As tampering with the odometer reading data generally has the objectiveof reducing the odometer reading data, the method ensures that theodometer reading, having the highest value transmitted on the data bus,is always stored by the storage means of the control units. In this way,when tampering which occurs with the odometer reading data at one of thecontrol units, this tampering is prevented from being spread to theother control units.

In addition, when a control unit is changed it is not necessary to resetthe odometer reading. The correct value is automatically accepted by thenew control unit when this method is applied.

In a further development of the method according to the invention,before the acceptance of the odometer reading data, the odometer readingdata transmitted on the data bus is checked for errors by a controlunit. This step is necessary, as there are a large number of errorsources. For example, as a result of the incorrect behaviour of acontroller or as a result of a software error or hardware fault in acontrol unit, incorrect data can get onto the data bus which could beinterpreted as odometer reading data. This would lead to a situation inwhich a single error on the data bus system would “age” the means oftransport by a random number of miles or kilometers. In addition, theodometer reading data on the data bus could also be tampered withintentionally because, of course, the data format of the data to betransmitted is known.

The acceptance of a relatively high odometer reading by a control unitis highly significant as this value is used for the further counting.Owing to the possible errors which can occur, it is necessary to ensurethat only correct odometer reading data is accepted by the controlunits. This is achieved by checking the odometer reading data beforeacceptance by the control unit.

There are various ways of advantageously configuring and developing theteaching of the present invention. In this respect, reference is made,on the one hand, to the subordinate claims and, on the other, to thefollowing explanation of an embodiment.

Other objects, advantages and novel features of the present inventionwill become apparent from the following detailed description of theinvention when considered in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

An embodiment according to the invention is illustrated in the drawingwherein:

FIG. 1 shows a device for carrying out the method according to theinvention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

A data bus 5 of a vehicle to which a primary control unit 1 and asecondary control unit 6 for carrying out the method according to theinvention are connected is illustrated schematically in FIG. 1. In thevehicle, the primary control unit 1 is connected directly to theinstrument cluster for displaying and measuring the odometer reading,while the secondary control unit 6 is implemented as a stand-alonecontrol unit.

The primary control unit 1 is electrically connected to an odometer 2, amicrocomputer 3 and a non-volatile storage means 4. The control unit 1receives the current odometer measurement by way of the odometer 2. Bymeans of the microcomputer 3, the distance which is determined is summedto form the odometer reading data stored in the storage means 4, and isstored and transmitted onto the data bus 5 in specific time periods.When an odometer reading is transmitted, the message counter for thetransmission of the odometer reading is always incremented by one andstored in the storage means 4. The code word is implemented by auniquely defined four-byte-long number which is defined by themanufacturer and is also stored in the storage means 4.

In the exemplary embodiment, the data bus system is a CAN bus, but themethod can be applied with any other bus system such as MOST or,FlexRay. In the CAN protocol it a message is, in principle, structuredas follows: “start of the message” designates the beginning of themessage, “message identifier” contains the identifier for distinguishingthe messages, the “check field” contains the code for the number of databytes in the “data field”, the “data field” contains the data to betransmitted, the “CRC field” contains a frame protection word fordetecting transmission faults, “reception confirmation” contains aconfirmation signal of all the receivers which have received the messagewithout errors and “end of message” marks the end of the message.

The “data field” which is transmitted onto the data bus by themicrocomputer 3 and has the length of eight bytes contains, in preciselythis order: the code word of the vehicle with a length of 4 bytes, themessage counter with a length of 1 byte and the actual odometer readingwith a length of 3 bytes.

The odometer reading data which is transmitted by the primary controlunit 1 is evaluated by a secondary control unit 6. The secondary controlunit 6 also has a non-volatile memory 7 in which its current odometerreading, its message counter, and the identification code of the vehicleare stored.

The storage means 4 and the non-volatile memory 7 are each implementedas non-volatile storage means as it is necessary to ensure that thecurrent odometer reading data is available after the vehicle has beenswitched off and started again.

If the transmitted odometer reading data of the primary control unit 1is higher than the odometer reading data stored in the storage means 7of the control unit 6, the control unit 6 carries out checking of the“data field” contained in the message of the data bus. The “data field”contains, as stated above: the code word, the message counter and thecurrent odometer reading. The code word of the transmitted message isfirst compared with the value stored on the memory 7 of the control unit6. From the correspondence, the difference in distance of the odometerreadings transmitted in three successive time periods is formed. If thisdifference in distance is not greater than a distance which ischaracteristic of the vehicle and if the message counter has beencorrectly incremented for the odometer reading data in question, thehigher odometer reading is accepted as the current odometer reading fromthe secondary control unit 6. The secondary control unit 6 stores thehigher reading in the non-volatile storage means and accepts it as avalue for the rest of the counting procedure.

The message counter can also be embodied as a circulating counter withlimited counting range whose counting starts again at zero when anoverflow occurs. It is to be emphasized that errors in the transmittingcontrol means are detected by the message counter.

In specific time periods, the secondary control unit 6 transmits ontothe data bus its currently stored odometer reading data in the sameformat, i.e. with a code word, updated message counter and its currentodometer reading.

The primary control unit 1 evaluates the transmitted odometer readingdata by using the same method steps as the secondary control unit 6. Ifthe odometer reading transmitted by the secondary control unit 6 ishigher than that of the primary control unit 1 and if the conditionsalready described above are fulfilled, the odometer reading on theprimary control unit 1 has been tampered or the primary control unit hasa technical defect. The primary control unit 1 then accepts the odometerreading of the secondary control unit 6 as a starting value for the restof the determination of the odometer reading.

The foregoing disclosure has been set forth merely to illustrate theinvention and is not intended to be limiting. Since modifications of thedisclosed embodiments incorporating the spirit and substance of theinvention may occur to persons skilled in the art, the invention shouldbe construed to include everything within the scope of the appendedclaims and equivalents thereof.

What is claimed is:
 1. A method for storing odometer reading data in avehicle having at least two control units which are each connected via adata bus, wherein the odometer reading data, which is determined at aparticular time by means of an odometers is stored in a first storagemeans of a first one of said at least two control units, said methodcomprising the steps of: storing the current odometer reading data of atleast a second one of said at least two control units on the data bus ina second storage means, transmitting by at least one of two controlunits, the odometer reading data, which is stored at a particular time,onto the data bus at specific time intervals, and accepting in one ofsaid control units, the odometer reading transmitted onto the data busif said reading is higher in value than a stored value, and using saidvalue for the further counting and storage in said one control unit. 2.The method according to claim 1, wherein, before the acceptance of theodometer reading data, the odometer reading data transmitted on the databus is checked for errors by one of said control units.
 3. The methodaccording to claim 2, wherein the odometer reading transmitted on thedata bus is accepted only if a code word of the transmitted odometerreading is identical to a code word of the vehicle.
 4. The methodaccording to claim 2, wherein the odometer reading transmitted on thedata bus is accepted only if a message counter of the transmittedodometer reading is incremented in a predetermined manner over aplurality of successive time periods.
 5. The method according to claim2, wherein the odometer reading which is transmitted on the data bus isaccepted only if the difference between the odometer readingstransmitted in a plurality of successive time periods does not exceed apredetermined distance which is characteristic of the vehicle.
 6. Themethod according to claim 1, wherein the odometer reading which istransmitted on the data bus is accepted only if the difference betweenthe odometer readings transmitted in a plurality of successive timeperiods does not exceed a predetermined distance which is characteristicof the vehicle.
 7. The method according to claim 6, wherein the odometerreading transmitted on the data bus is accepted only if a code word ofthe transmitted odometer reading is identical to a code word of thevehicle.
 8. The method according to claim 6, wherein the odometerreading transmitted on the data bus is accepted only if a messagecounter of the transmitted odometer reading is incremented in apredetermined manner over a plurality of successive time periods.
 9. Themethod according to claim 1, wherein, when it is transmitted, theodometer reading data is supplemented with a code word which is uniquelydefined for the vehicle, in order to ensure that the message has beentransmitted by one of said units.
 10. The method according to claim 9,wherein the odometer reading transmitted on the data bus is acceptedonly if a code word of the transmitted odometer reading is identical toa code word of the vehicle.
 11. The method according to claim 9, whereinthe odometer reading transmitted on the data bus is accepted only if amessage counter of the transmitted odometer reading is incremented in apredetermined manner over a plurality of successive time periods. 12.The method according to claim 1, wherein, when it is transmitted, theodometer reading data is supplemented with a message counter whose valueis a counter for the number of transmitted odometer reading data itemsof one of said control units.
 13. The method according to claim 12,wherein the odometer reading transmitted on the data bus is acceptedonly if a message counter of the transmitted odometer reading isincremented in a predetermined manner over a plurality of successivetime periods.